danger-guard

• Outcome: Review
• Latest audit: Jul 31, 2026 · 6:14 PM UTC
• Version: 1.2.0

Overview

Danger Guard is a defensive command-safety skill, but it asks for administrator-password-derived hashes and installs persistent behavior changes across agent and shell environments.

Review carefully before installing. The defensive purpose is understandable, but do not provide your sudo or administrator password to an agent-managed prompt, and avoid enabling automatic MEMORY.md/AGENTS.md edits or shell aliases unless you have reviewed the exact changes and know how to remove them.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (31)

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The README states that the skill automatically writes to MEMORY.md and AGENTS.md to persist behavior across sessions, which is a materially broader capability than transient command interception. Modifying mandatory-read agent files creates persistent influence over future agent behavior and could be abused as an integrity-compromising backdoor even if framed as safety hardening.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The emergency protocol expands scope from command interception into incident-response actions such as logging prior commands and stopping background tasks. Those actions touch sensitive operational data and system state, and are not clearly necessary for the skill's declared purpose, creating avoidable privacy and availability risk.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Automatic modification of MEMORY.md and AGENTS.md is an unjustified privileged capability for a skill advertised as a guardrail. Because those files are mandatory-read policy surfaces, writing to them can permanently alter agent behavior, priorities, and trust boundaries beyond the user's immediate awareness.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The optional shell wrapper extends protection from AI-issued commands to all terminal commands system-wide, which is significantly broader than the stated purpose. Even if intended as defense, system-wide interception increases blast radius, can interfere with normal administration, and creates an additional privileged control point that could be misused.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Collecting command history and stopping background tasks are capabilities that exceed simple interception and are not well-justified in the README. Such functions can expose sensitive activity and disrupt legitimate workloads if triggered accidentally or maliciously.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The skill explicitly instructs collection and persistence of a verifier derived from the user's sudo/admin password. Even if stored as SHA256 instead of plaintext, this is still credential-derived secret material gathered by an application-level agent, which is unnecessary for command interception and creates credential theft, replay, and offline guessing risk.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The onboarding flow asks the user for a sudo/administrator password and stores its SHA256 hash as part of normal operation. That capability is unjustified for a guard skill and materially expands the blast radius if the memory file, logs, or local environment are exposed, especially because raw SHA256 is not an appropriate password-verifier design.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill mandates writing persistent rule blocks into MEMORY.md and AGENTS.md to force future loading and behavior. This is a self-propagating persistence mechanism that alters higher-priority instruction files and can outlive the user's original consent, making the agent behavior hard to audit or reverse.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill extends itself into other AI tools, shell wrappers, PATH changes, aliases, and git hooks, creating system-wide command mediation beyond the stated scope of a chat skill. This broad persistence and cross-tool control increase the chance of misuse, breakage, and unauthorized behavior changes across the user's environment.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The security notice claims equivalence to Keychain/PAM, but the documented design is only application-level SHA256 hashing of a user-entered password. This is misleading and unsafe because SHA256 without a proper password hashing scheme, salt, and OS protections does not provide the same security properties as native credential systems.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README states that installation automatically writes rules into MEMORY.md and AGENTS.md to influence future agent behavior, but it does not present this as a sensitive modification requiring explicit user consent or backup. Because these are high-priority instruction files, silent modification can alter agent behavior across sessions and projects, creating a persistence and integrity risk if the skill is misconfigured or abused.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The emergency protocol says the tool records the last 50 commands to a security-breach file, but the README does not warn that command history may contain secrets, credentials, paths, or sensitive operational data. In a compromise scenario this logging could increase exposure by storing highly sensitive context in another file without retention or access-control guidance.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README describes automatic writes into mandatory-read files without a prominent up-front warning about persistence and integrity impact. Silent or low-visibility modification of core agent instruction files undermines informed consent and increases the chance users deploy persistent behavior changes they do not fully understand.

Vague Triggers

High

• Confidence: 91% confidence
• Finding: The trigger conditions are broad and loosely defined, causing the skill to activate on many ordinary administrative or development tasks. Overbroad interception can train users to bypass warnings, create denial-of-service against normal work, and make the guard unreliable when precision matters.

Vague Triggers

High

• Confidence: 96% confidence
• Finding: The instruction to trigger on any occurrence of 'rm' without exceptions is excessively vague and guarantees false positives, including harmless text references or safe file removals. Such behavior degrades trust in the guard and can be abused to interfere with normal agent operation.

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The forced policy to intercept on keyword appearance alone, regardless of completeness or intent, is ambiguous and unsafe. It enables accidental activation from documentation, examples, or partial commands and makes the skill behavior easy to manipulate through prompt content.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill directs mandatory writes to persistent instruction files without a clear, upfront warning that it is modifying durable agent-control artifacts. Persistent modification of trust and behavior files is security-sensitive because it changes future execution semantics beyond the current task.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The onboarding prompt requests the user's sudo/admin password without adequate warning about the sensitivity of a reusable system secret. Soliciting privileged credentials in-band through an agent is dangerous because users may disclose secrets to an untrusted or compromised component.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The shell-wrapper setup modifies shell startup files and installs persistent command interception without prominently warning about long-term, system-wide behavior changes. This can unexpectedly affect all future shell sessions and commands, creating operational and security risks.

Ssd 3

Medium

• Confidence: 90% confidence
• Finding: Persisting the last 50 commands in a breach log creates a new repository of sensitive operational data, which may include secrets, file paths, infrastructure details, or proprietary commands. Triggered logging on a phrase alone can be abused to force sensitive data collection and retention.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The skill normalizes solicitation and storage of a password verifier derived from a privileged system credential. Collecting credential-derived material as part of routine operation is a sensitive-data handling flaw and unnecessary for a defensive command guard.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The onboarding procedure directly asks for the sudo/administrator password and persists a SHA256-derived verifier to memory. This creates a sensitive-secret collection channel and a durable credential artifact that may be exfiltrated or brute-forced offline.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The shell-wrapper instructions explicitly store a hash derived from the user's sudo password in a local file. This is a persistent credential-derived artifact outside native secure storage, making it attractive for theft and offline cracking while providing weak assurance compared with real OS authentication.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

### 配置说明

- **工作原理**: Shell wrapper 拦截指定的命令，检查是否匹配危险模式，如果匹配则要求输入 sudo 密码验证
- **密码验证**: 使用 SHA-256 哈希比对，密码存储在 `~/.danger-guard.json`（由 OpenClaw 配置）
- **日志记录**: 所有拦截和执行的命令记录在 `~/.danger-guard.log`
- **最大尝试次数**: 密码验证失败 3 次后拦截命令

• Confidence: 81% confidence
• Finding: The documentation describes a shell wrapper that prompts users to enter a 'sudo password' and stores a SHA-256 hash in a user-controlled file. Even though intended as a safety gate, collecting and verifying privileged credentials inside a custom script creates credential-handling risk, trains users to disclose sensitive passwords to non-system prompts, and could expose or misuse those credentials if the wrapper or storage is altered.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

检测到系统：macOS

第 1 步：输入 sudo 密码（开机密码）
  → 以 SHA256 哈希存储，不明文保存

第 2 步：邮件告警？（可选）

• Confidence: 89% confidence
• Finding: The onboarding flow asks the user to enter their sudo password and says a SHA256 hash will be stored. Collecting an administrator password inside a skill is dangerous because a simple hash is not suitable for password verification at this trust boundary, and normal sudo validation should be delegated to the OS rather than copied into app-managed storage. This creates a credential-handling and potential password-capture risk.

Static analysis

No suspicious patterns detected.